CVE-2024-47575
Fortinet FortiManager Missing Authentication Vulnerability
Description
CVE-2024-47575 is a critical missing authentication vulnerability in Fortinet FortiManager that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. The flaw affects FortiManager versions 6.2.0 through 7.6.0 and FortiManager Cloud versions 6.4.1 through 7.4.4, where a critical function lacks proper authentication checks. With a CVSS v3.1 base score of 9.8 (CRITICAL), a network-accessible attack vector, and no privileges or user interaction required, this vulnerability represents an extreme risk. CISA has added CVE-2024-47575 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 13, 2024, and its EPSS score of 93.85% at the 99.9th percentile confirms near-universal exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortimanager | >= 6.2.0, < 6.2.13; >= 6.4.0, < 6.4.15; >= 7.0.0, < 7.0.13; >= 7.2.0, < 7.2.8; >= 7.4.0, < 7.4.5; 7.6.0 |
| fortinet | fortimanager cloud | >= 6.4.1, <= 6.4.7; >= 7.0.1, < 7.0.13; >= 7.2.1, < 7.2.8; >= 7.4.1, < 7.4.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-423(Exploit, Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-47575(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2024-47575 exploits a missing authentication for critical function weakness in FortiManager's FGFM (FortiGate to FortiManager) protocol handler. The vulnerability allows an unauthenticated attacker to access privileged management functions that should require authentication, enabling them to execute arbitrary code or commands on the FortiManager appliance. This type of weakness occurs when software does not perform any authentication for functionality that requires a provable user identity or consumes significant resources.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
The impact of CVE-2024-47575 is devastating across all three security pillars, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), making it trivially exploitable by any attacker with network access to the FortiManager FGFM service. FortiManager is a centralized management platform that controls hundreds or thousands of FortiGate firewalls across an enterprise, meaning a single compromise gives the attacker complete control over the entire network security infrastructure. Successful exploitation enables attackers to extract managed device configurations including credentials, deploy malicious policies to all managed firewalls, pivot into internal networks, and maintain persistent backdoor access. The EPSS score of 93.85% at the 99.9th percentile places this among the most actively exploited vulnerabilities ever tracked. While the ransomware nexus is currently listed as Unknown, the attack has been attributed to sophisticated threat actors conducting espionage campaigns targeting government and critical infrastructure organizations.
Exploit Maturity
CVE-2024-47575 has reached maximum exploit maturity, commonly referred to as "FortiJump" in the security community. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 13, 2024. The EPSS score of 93.85% at the 99.9th percentile places it among the most actively exploited vulnerabilities globally. Fortinet published a detailed advisory at FG-IR-24-423 confirming exploitation in the wild. The vulnerability was discovered being actively exploited by a sophisticated threat actor who registered unauthorized FortiGate devices to compromised FortiManagers and used them to exfiltrate configurations, credentials, and certificates. Mass scanning and exploitation activity was reported across the internet shortly after disclosure, with threat actors automating the exploitation pipeline to compromise exposed FortiManager instances at scale.
Remediation
-
Upgrade FortiManager immediately to the patched versions: FortiManager 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later, as detailed in the Fortinet advisory FG-IR-24-423. FortiManager Cloud customers should upgrade to 7.4.5 or later, 7.2.8 or later, or 7.0.13 or later.
-
Apply the immediate workaround if patching is not possible: restrict FGFM access by configuring the "set fgfm-deny-unknown enable" option to reject connections from unknown FortiGate serial numbers. On FortiManager versions 7.2.0 and above, add local-in policies to whitelist specific IP addresses permitted to connect.
-
Audit FortiManager for indicators of compromise by reviewing the list of registered FortiGate devices for any unauthorized entries, checking for unexpected configuration changes or policy deployments, examining event logs for anomalous FGFM connections, and verifying that no new admin accounts were created.
-
Rotate all managed credentials including FortiGate admin passwords, VPN pre-shared keys, certificates, and any other sensitive configuration data managed through FortiManager. Assume that all configuration data accessible through FortiManager has been exfiltrated.
-
Restrict network access to the FGFM service (TCP port 541) to only authorized FortiGate devices using network-level access control lists. FortiManager management interfaces should never be directly exposed to the internet.
Technical Details
CVE-2024-47575 is a missing authentication vulnerability in FortiManager's FortiGate-to-FortiManager (FGFM) protocol handler. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The FGFM protocol is used for communication between FortiGate appliances and their FortiManager, typically running on TCP port 541. The vulnerability exists because critical management functions exposed through the FGFM protocol can be invoked without proper authentication validation. An attacker can craft FGFM protocol messages that register a rogue FortiGate device to the target FortiManager without valid credentials or device serial number verification. Once registered, the attacker's device has access to the same management API as legitimate FortiGates, enabling execution of arbitrary commands on the FortiManager with root-level privileges. The attack mechanism involves forging FGFM registration requests, establishing a trusted management session, and then leveraging that session to execute commands, extract configurations, deploy policies, and exfiltrate sensitive data from all managed devices.
Frequently Asked Questions
Is CVE-2024-47575 being actively exploited?
Yes, CVE-2024-47575 is under widespread active exploitation, commonly known as "FortiJump." CISA added it to the Known Exploited Vulnerabilities catalog, and Fortinet confirmed exploitation in the wild. The EPSS score of 93.85% at the 99.9th percentile indicates near-universal exploitation.
What products are affected by CVE-2024-47575?
FortiManager versions 6.2.0 through 7.6.0 and FortiManager Cloud versions 6.4.1 through 7.4.4 are affected. This includes on-premises FortiManager appliances and cloud-hosted FortiManager instances managing FortiGate firewalls.
How do I fix CVE-2024-47575?
Upgrade FortiManager to a patched version (7.6.1+, 7.4.5+, 7.2.8+, 7.0.13+, or 6.4.15+). As an immediate workaround, enable "set fgfm-deny-unknown" to reject connections from unknown devices. Audit for unauthorized device registrations and rotate all managed credentials.
How severe is CVE-2024-47575?
CVE-2024-47575 is rated CRITICAL with a maximum CVSS v3.1 score of 9.8. Because FortiManager centrally manages enterprise firewall infrastructure, a single compromise can give attackers control over an organization's entire network perimeter security, making this one of the most impactful vulnerabilities of 2024.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.